docker-compose.yml

---

services:
  controller:
    build:
      context: .
      dockerfile: Dockerfile-dalton
      args:
        - http_proxy=${http_proxy}
        - https_proxy=${https_proxy}
        - no_proxy=${no_proxy}
    image: dalton:latest
    container_name: dalton_controller
    # Uncomment the next line to run the app in debug mode
    # command: flask --app app run --port=8080 --host=0.0.0.0 --debug
    depends_on:
      - redis
    environment:
      - CONTROLLER_DEBUG=${CONTROLLER_DEBUG}
    volumes:
      - ./app:/opt/dalton/app
      - ./rulesets:/opt/dalton/rulesets
      - ./engine-configs:/opt/dalton/engine-configs
    restart: always

  nginx:
    build:
      context: .
      dockerfile: Dockerfile-nginx
      args:
        - DALTON_EXTERNAL_PORT=${DALTON_EXTERNAL_PORT}
        - DALTON_EXTERNAL_PORT_SSL=${DALTON_EXTERNAL_PORT_SSL}
    image: nginx-dalton:latest
    container_name: dalton_web
    depends_on:
      - controller
    ports:
        # external HTTP listen port
        # to change, set DALTON_EXTERNAL_PORT in the '.env' file (NOT here)
        # default DALTON_EXTERNAL_PORT value: 80
      - "${DALTON_EXTERNAL_PORT}:80"

        # uncomment below line to expose the external SSL/TLS listener
        # to change port, set DALTON_EXTERNAL_PORT_SSL in the '.env' file (NOT here)
        # default DALTON_EXTERNAL_PORT_SSL value: 443
#      - "${DALTON_EXTERNAL_PORT_SSL}:443"
    restart: always

  redis:
    image: redis:7.4.1
    container_name: dalton_redis  
    restart: always


###########################
###### Dalton Agents ######
###########################
# To add a new, different, or another Agent for a
# particular Suricata or Snort version, just copy
# one of the existing specifications and change the
# version number(s) as necessary.  For Suricata this
# is the "SURI_VERSION" arg value; for Snort this is
# the "SNORT_VERSION" arg value (and possibly DAQ_VERSION).
# The service and container name will also need to be
# changed to be unique.

###########################
##### Suricata Agents #####
###########################

# NOTE: Suricata version 4 supports Rust but is optional. To enable Rust
# support for a Suricata 4.x Agent, set the "ENABLE_RUST" arg
# to "--enable-rust". e.g.:
#        - ENABLE_RUST=--enable-rust

# Suricata current (latest) from source
  agent-suricata-current:
    build:
      context: ./dalton-agent
      dockerfile: Dockerfiles/Dockerfile_suricata
      args:
        - SURI_VERSION=current
        - http_proxy=${http_proxy}
        - https_proxy=${https_proxy}
        - no_proxy=${no_proxy}
    image: suricata-current:latest
    container_name: suricata-current
    environment:
      - AGENT_DEBUG=${AGENT_DEBUG}
    restart: always

# Suricata 6.0.20 from source, with Rust support
  agent-suricata-6.0.20:
    build:
      context: ./dalton-agent
      dockerfile: Dockerfiles/Dockerfile_suricata
      args:
        - SURI_VERSION=6.0.20
        - http_proxy=${http_proxy}
        - https_proxy=${https_proxy}
        - no_proxy=${no_proxy}
    image: suricata-6.0.20:latest
    container_name: suricata-6.0.20
    environment:
      - AGENT_DEBUG=${AGENT_DEBUG}
    restart: always

# Suricata 5.0.6 from source, with Rust support
#  agent-suricata-5.0.7:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=5.0.7
#        - ENABLE_RUST=--enable-rust
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-5.0.7:latest
#    container_name: suricata-5.0.7
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 4.1.10 from source, with Rust support
#  agent-suricata-4.1.10:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=4.1.10
#        - ENABLE_RUST=--enable-rust
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-4.1.10:latest
#    container_name: suricata-4.1.10
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 4.0.7 from source
#  agent-suricata-4.0.7:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=4.0.7
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-4.0.7:latest
#    container_name: suricata-4.0.7
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 3.2.5 from source
#  agent-suricata-3.2.5:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=3.2.5
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-3.2.5:latest
#    container_name: suricata-3.2.5
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 3.1.4 from source
#  agent-suricata-3.1.4:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=3.1.4
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-3.1.4:latest
#    container_name: suricata-3.1.4
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 2.0.11 from source
#  agent-suricata-2.0.11:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=2.0.11
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-2.0.11:latest
#    container_name: suricata-2.0.11
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 2.0 from source
#  agent-suricata-2.0:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=2.0
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-2.0:latest
#    container_name: suricata-2.0
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 1.4.7 from source
#  agent-suricata-1.4.7:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=1.4.7
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-1.4.7:latest
#    container_name: suricata-1.4.7
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Suricata 1.3.6 from source
#  agent-suricata-1.3.6:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_suricata
#      args:
#        - SURI_VERSION=1.3.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: suricata-1.3.6:latest
#    container_name: suricata-1.3.6
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always


###########################
###### Snort Agents #######
###########################
#
# Note: Attempting to build Snort 2.9.0 and 2.9.0.x
#  will fail because Autoconf can't find the dnet files.
#  This was apparently fixed in Snort > 2.9.1 so if
#  you really want a Snort 2.9.0 or 2.9.0.x, feel free
#  to build it yourself.  The Dalton Agent should work
#  fine on it.
#

# Snort 2.9.20 from source
  agent-snort-2.9.20:
    build:
      context: ./dalton-agent
      dockerfile: Dockerfiles/Dockerfile_snort
      args:
        - SNORT_VERSION=2.9.20
        - DAQ_VERSION=2.0.7
        - http_proxy=${http_proxy}
        - https_proxy=${https_proxy}
        - no_proxy=${no_proxy}
    image: snort-2.9.20:latest
    container_name: snort-2.9.20
    environment:
      - AGENT_DEBUG=${AGENT_DEBUG}
    restart: always

# Snort 2.9.18 from source
#  agent-snort-2.9.18.1:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.18.1
#        - DAQ_VERSION=2.0.7
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.18.1:latest
#    container_name: snort-2.9.18.1
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# NOTE: Snort 2.9.16 is when DAQ version went to 2.0.7 (from 2.0.6).

# Snort 2.9.15.1 from source
#  agent-snort-2.9.15.1:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.15.1
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.15.1:latest
#    container_name: snort-2.9.15.1
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Snort 2.9.14.1 from source
#  agent-snort-2.9.14.1:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.14.1
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.14.1:latest
#    container_name: snort-2.9.14.1
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Snort 2.9.9.0 from source
#  agent-snort-2.9.9.0:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.9.0
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.9.0:latest
#    container_name: snort-2.9.9.0
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Snort 2.9.8.3 from source
#  agent-snort-2.9.8.3:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.8.3
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.8.3:latest
#    container_name: snort-2.9.8.3
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Snort 2.9.7.5 from source
#  agent-snort-2.9.7.5:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.7.5
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.7.5:latest
#    container_name: snort-2.9.7.5
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Snort 2.9.3.1 from source
#  agent-snort-2.9.3.1:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.3.1
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.3.1:latest
#    container_name: snort-2.9.3.1
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

# Snort 2.9.1.1 from source
#  agent-snort-2.9.1.1:
#    build:
#      context: ./dalton-agent
#      dockerfile: Dockerfiles/Dockerfile_snort
#      args:
#        - SNORT_VERSION=2.9.1.1
#        - DAQ_VERSION=2.0.6
#        - http_proxy=${http_proxy}
#        - https_proxy=${https_proxy}
#        - no_proxy=${no_proxy}
#    image: snort-2.9.1.1:latest
#    container_name: snort-2.9.1.1
#    environment:
#      - AGENT_DEBUG=${AGENT_DEBUG}
#    restart: always

###########################
####### Zeek Agents #######
###########################

# Zeek current (latest) from source
  agent-zeek-current:
    build:
      context: ./dalton-agent
      dockerfile: Dockerfiles/Dockerfile_zeek
      args:
        - ZEEK_VERSION=7.0.1
    image: zeek-current:latest
    container_name: zeek-current
    volumes:
      - ./rulesets/zeek:/opt/dalton-agent/zeek_scripts:ro
    restart: always

  agent-zeek-6.0.6:
    build:
      context: ./dalton-agent
      dockerfile: Dockerfiles/Dockerfile_zeek
      args:
        - ZEEK_VERSION=6.0.6
    image: zeek-6.0.6
    container_name: zeek-6.0.6
    volumes:
      - ./rulesets/zeek:/opt/dalton-agent/zeek_scripts:ro
    restart: always